1515#include "esp_event.h"
1616#include "esp_wifi.h"
1717#include "common/ieee802_11_defs.h"
18+ #include "common/ieee802_11_common.h"
1819#include "esp_wps_i.h"
1920#include "rsn_supp/wpa.h"
2021#include "rsn_supp/pmksa_cache.h"
@@ -575,6 +576,7 @@ static void esp_dpp_task(void *pvParameters)
575576 break ;
576577 }
577578 channel = p -> chan_list [counter ++ % p -> num_chan ];
579+ wpa_printf (MSG_DEBUG , "Listening on channel=%d" , channel );
578580 ret = esp_wifi_remain_on_channel (WIFI_IF_STA , WIFI_ROC_REQ , channel ,
579581 BOOTSTRAP_ROC_WAIT_TIME , s_action_rx_cb );
580582 if (ret != ESP_OK ) {
@@ -687,47 +689,81 @@ static void offchan_event_handler(void *arg, esp_event_base_t event_base,
687689static char * esp_dpp_parse_chan_list (const char * chan_list )
688690{
689691 struct dpp_bootstrap_params_t * params = & s_dpp_ctx .bootstrap_params ;
690- char * uri_channels = os_zalloc (14 * 6 + 1 );
691- const char * pos = chan_list ;
692- const char * pos2 ;
693- char * pos3 = uri_channels ;
692+ size_t max_uri_len = ESP_DPP_MAX_CHAN_COUNT * 8 + strlen (" chan=" ) + 1 ;
693+
694+ char * uri_channels = os_zalloc (max_uri_len );
695+ if (!uri_channels ) {
696+ wpa_printf (MSG_WARNING , "DPP: URI allocation failed" );
697+ return NULL ;
698+ }
699+
700+ char * uri_ptr = uri_channels ;
694701 params -> num_chan = 0 ;
695702
696- os_memcpy (pos3 , " chan=" , strlen (" chan=" ));
697- pos3 += strlen (" chan=" );
703+ /* Append " chan=" at the beginning of the URI */
704+ strcpy (uri_ptr , " chan=" );
705+ uri_ptr += strlen (" chan=" );
698706
699- while (pos && * pos ) {
700- int channel ;
701- int len = strlen (chan_list );
707+ while (* chan_list && params -> num_chan < ESP_DPP_MAX_CHAN_COUNT ) {
708+ int channel = 0 ;
702709
703- pos2 = pos ;
704- while (* pos2 >= '0' && * pos2 <= '9' ) {
705- pos2 ++ ;
710+ /* Parse the channel number */
711+ while (* chan_list >= '0' && * chan_list <= '9' ) {
712+ channel = channel * 10 + (* chan_list - '0' );
713+ chan_list ++ ;
706714 }
707- if (* pos2 == ',' || * pos2 == ' ' || * pos2 == '\0' ) {
708- channel = atoi (pos );
709- if (channel < 1 || channel > 14 ) {
710- os_free (uri_channels );
711- return NULL ;
715+
716+ /* Validate the channel number */
717+ if (CHANNEL_TO_BIT_NUMBER (channel ) == 0 ) {
718+ wpa_printf (MSG_WARNING , "DPP: Skipping invalid channel %d" , channel );
719+ /* Skip to the next valid entry */
720+ while (* chan_list == ',' || * chan_list == ' ' ) {
721+ chan_list ++ ;
712722 }
713- params -> chan_list [params -> num_chan ++ ] = channel ;
714- os_memcpy (pos3 , "81/" , strlen ("81/" ));
715- pos3 += strlen ("81/" );
716- os_memcpy (pos3 , pos , (pos2 - pos ));
717- pos3 += (pos2 - pos );
718- * pos3 ++ = ',' ;
719-
720- pos = pos2 + 1 ;
723+ continue ; // Skip the bad channel and move to the next one
721724 }
722- while (* pos == ',' || * pos == ' ' || * pos == '\0' ) {
723- pos ++ ;
725+
726+ /* Get the operating class for the channel */
727+ u8 oper_class = get_operating_class (channel , 0 );
728+ if (oper_class == 0 ) {
729+ wpa_printf (MSG_WARNING , "DPP: Skipping channel %d due to missing operating class" , channel );
730+ /* Skip to the next valid entry */
731+ while (* chan_list == ',' || * chan_list == ' ' ) {
732+ chan_list ++ ;
733+ }
734+ continue ; /* Skip to the next channel if no operating class found */
724735 }
725736
726- if (((int )(pos - chan_list ) >= len )) {
727- break ;
737+ /* Add the valid channel to the list */
738+ params -> chan_list [params -> num_chan ++ ] = channel ;
739+
740+ /* Check if there's space left in uri_channels buffer */
741+ size_t remaining_space = max_uri_len - (uri_ptr - uri_channels );
742+ if (remaining_space <= 8 ) { // Oper class + "/" + channel + "," + null terminator
743+ wpa_printf (MSG_ERROR , "DPP: Not enough space in URI buffer" );
744+ os_free (uri_channels );
745+ return NULL ;
728746 }
747+
748+ /* Append the operating class and channel to the URI */
749+ uri_ptr += sprintf (uri_ptr , "%d/%d," , oper_class , channel );
750+
751+ /* Skip any delimiters (comma or space) */
752+ while (* chan_list == ',' || * chan_list == ' ' ) {
753+ chan_list ++ ;
754+ }
755+ }
756+
757+ if (!params -> num_chan ) {
758+ wpa_printf (MSG_ERROR , "DPP: No valid channel in the list" );
759+ os_free (uri_channels );
760+ return NULL ;
761+ }
762+
763+ /* Replace the last comma with a space if there was content added */
764+ if (uri_ptr > uri_channels && * (uri_ptr - 1 ) == ',' ) {
765+ * (uri_ptr - 1 ) = ' ' ;
729766 }
730- * (pos3 - 1 ) = ' ' ;
731767
732768 return uri_channels ;
733769}
@@ -742,10 +778,16 @@ esp_supp_dpp_bootstrap_gen(const char *chan_list, enum dpp_bootstrap_type type,
742778 }
743779 struct dpp_bootstrap_params_t * params = & s_dpp_ctx .bootstrap_params ;
744780 char * uri_chan_list = esp_dpp_parse_chan_list (chan_list );
781+
782+ if (params -> num_chan > ESP_DPP_MAX_CHAN_COUNT ) {
783+ os_free (uri_chan_list );
784+ return ESP_ERR_DPP_INVALID_LIST ;
785+ }
786+
745787 char * command = os_zalloc (1200 );
746788 int ret ;
747789
748- if (!uri_chan_list || !command || params -> num_chan >= 14 || params -> num_chan == 0 ) {
790+ if (!uri_chan_list || !command || params -> num_chan > ESP_DPP_MAX_CHAN_COUNT || params -> num_chan == 0 ) {
749791 wpa_printf (MSG_ERROR , "Invalid Channel list - %s" , chan_list );
750792 if (command ) {
751793 os_free (command );
0 commit comments